centrex/laravel-open-exchange-rates

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script. This is common Composer behavior, but it adds install-time execution that consumers should account for.

Repo bus factorcaution

One contributor made all seven commits in the last three months. Organization ownership provides some handoff capacity, but no second active contributor is shown, leaving a real continuity risk.

Security policycaution

The repository has no security policy file. This is a transparency gap for reporting and handling vulnerabilities, although it is not evidence of an unsafe release by itself.

Workflow auditcaution

All 13 analyzed action references are unpinned, and four workflows grant top-level write permissions. The audit also found one high-confidence, high-severity bot-conditions issue in the Dependabot auto-merge workflow, while no untrusted checkout or script-injection sink was found.